Security fixes are released as new 1.x patch versions of the affected modules.

Please report security vulnerabilities using GitHub's private vulnerability reporting feature (Security tab → Report a vulnerability). Do not open a public issue for security-sensitive reports.

You should receive an initial response within a reasonable timeframe. If the vulnerability is confirmed, a fix will be released and credited in the CHANGELOG.